Enabling the High Security Plugin ... what to watch out for

[Michael Domke]

My company is considering implementing the High Security Plugin. We've used ServiceNow for quite some time (one of the first 100 I believe) and have, as you would expect, created various groups, roles and ACLs to accommodate a wide variety of processes.

We're experiencing tremendous growth and as such many more departments beyond just IT and HR are starting to (or wanting to) rely on ServiceNow. So, security is becoming more of an issue.

My question to this community is to ask what are some of the things we should look out for? I'm sure several pre-High Security Plugin companies have since implemented the plugin and I would be very interested in listening to any comments regarding their experiences after enabling the plugin.

Any specific pain points? What you might have done differently before/after enabling the plugin?

Any feedback would be greatly appreciated.

Thanks,
Michael

[Valor1]

Michael,
You're an old enough customer that I have to ask.. have you switched to using Contextual Security from the legacy field-dictionary style security yet?

If you are still using the legacy security model, that move will be the hardest for you.

Howevery, if you're already using Contextual Security (I hope so!), the addition of the High Security plugin is relatively trivial. The things you would would need to look out for
* any "AJAXEvaluate" calls in client scripts. This is a HUGE security issue, and would need to be eliminated regardless.
* any client scripts that set fields marked read only by Contextual Security rules

Aside from those two bullets, you would just need to test, test, test. With High Security plugin, it's typically that you need to ALLOW more access than granted by default.

[Valor1]

<< accidental double post >>

[andreafaustina]

Have you activated the high security plugin since your post?   Could you share your experience?   Thank you!!

[Michael Domke]

Unfortunately, we have not enabled the high security plugin. It's still something we talk about but as Valor mentioned, it's the "test,test,test" part that keeps pushing this down the requirement list for us.